IBM Emptoris Sourcing Multiple Cross Site Scripting and Open Redirection Vulnerabilities
BID:99545
Info
IBM Emptoris Sourcing Multiple Cross Site Scripting and Open Redirection Vulnerabilities
| Bugtraq ID: | 99545 |
| Class: | Input Validation Error |
| CVE: |
CVE-2016-8950 CVE-2016-8947 CVE-2016-8953 CVE-2016-8946 CVE-2016-8948 CVE-2016-6114 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 12 2017 12:00AM |
| Updated: | Jul 12 2017 12:00AM |
| Credit: | IBM |
| Vulnerable: |
IBM Emptoris Sourcing 10.1 IBM Emptoris Sourcing 9.5 |
| Not Vulnerable: | |
Discussion
IBM Emptoris Sourcing Multiple Cross Site Scripting and Open Redirection Vulnerabilities
IBM Emptoris Sourcing is prone to multiple cross-site scripting and an open-redirection vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, this may allow the attacker to steal cookie-based authentication credentials and to launch other attacks or by constructing a crafted URI and enticing a user to follow it and when an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site.
IBM Emptoris Sourcing 9.5.x through 10.1.x are vulnerable.
IBM Emptoris Sourcing is prone to multiple cross-site scripting and an open-redirection vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, this may allow the attacker to steal cookie-based authentication credentials and to launch other attacks or by constructing a crafted URI and enticing a user to follow it and when an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site.
IBM Emptoris Sourcing 9.5.x through 10.1.x are vulnerable.
Exploit / POC
IBM Emptoris Sourcing Multiple Cross Site Scripting and Open Redirection Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
IBM Emptoris Sourcing Multiple Cross Site Scripting and Open Redirection Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
IBM Emptoris Sourcing Multiple Cross Site Scripting and Open Redirection Vulnerabilities
References:
References: